Examples and prevention tips.

Social engineering is the art of manipulating people so they give up confidential information. The types of information these criminals are seeking can vary, but when individuals are targeted the criminals are usually trying to trick you into giving them your passwords or bank information, or access your computer to secretly install malicious software–that will give them access to your passwords and bank information as well as giving them control over your computer.

Criminals use social engineering tactics because it is usually easier to exploit your natural inclination to trust than it is to discover ways to hack your software.  For example, it is much easier to fool someone into giving you their password than it is for you to try hacking their password (unless the password is really weak).

Security is all about knowing who and what to trust. It is important to know when and when not to take a person at their word and when the person you are communicating with is who they say they are. The same is true of online interactions and website usage: when do you trust that the website you are using is legitimate or is safe to provide your information?

Ask any security professional and they will tell you that the weakest link in the security chain is the human who accepts a person or scenario at face value. It doesn’t matter how many locks and deadbolts are on your doors and windows, or if have guard dogs, alarm systems, floodlights, fences with barbed wire, and armed security personnel; if you trust the person at the gate who says he is the pizza delivery guy and you let him in without first checking to see if he is legitimate you are completely exposed to whatever risk he represents.

What Does a Social Engineering Attack Look Like?

Email from a friend

f a criminal manages to hack or socially engineer one person’s email password they have access to that person’s contact list–and because most people use one password everywhere, they probably have access to that person’s social networking contacts as well.

Once the criminal has that email account under their control, they send emails to all the person’s contacts or leave messages on all their friend’s social pages, and possibly on the pages of the person’s friend’s friends.

Taking advantage of your trust and curiosity, these messages will:

• Contain a link that you just have to check out–and because the link comes from a friend and you’re curious, you’ll trust the link and click–and be infected with malware so the criminal can take over your machine and collect your contacts info and deceive them just like you were deceived
• Contain a download of pictures, music, movie, document, etc., that has malicious software embedded. If you download–which you are likely to do since you think it is from your friend–you become infected. Now, the criminal has access to your machine, email account, social network accounts and contacts, and the attack spreads to everyone you know. And on, and on.

Email from another trusted source

Phishing attacks are a subset of social engineering strategy that imitate a trusted source and concoct a seemingly logical scenario for handing over login credentials or other sensitive personal data. According to Web-root data, financial institutions represent the vast majority of impersonated companies and, according to Verizon’s annual Data Breach Investigations Report, social engineering attacks including phishing and preexisting (see below) are responsible for 93% of successful data breaches.

Using a compelling story or pretext, these messages may:

• Urgently ask for your help. Your ’friend’ is stuck in country X, has been robbed, beaten, and is in the hospital. They need you to send money so they can get home and they tell you how to send the money to the criminal.
• Use phishing attempts with a legitimate-seeming background. Typically, a phisher sends an e-mail, IM, comment, or text message that appears to come from a legitimate, popular company, bank, school, or institution.
• Ask you to donate to their charitable fundraiser, or some other cause. Likely with instructions on how to send the money to the criminal. Preying on kindness and generosity, these phishers ask for aid or support for whatever disaster, political campaign, or charity is momentarily top-of-mind.
• Present a problem that requires you to “verify” your information by clicking on the displayed link and providing information in their form. The link location may look very legitimate with all the right logos, and content (in fact, the criminals may have copied the exact format and content of the legitimate site). Because everything looks legitimate, you trust the email and the phony site and provide whatever information the crook is asking for. These types of phishing scams often include a warning of what will happen if you fail to act soon because criminals know that if they can get you to act before you think, you’re more likely to fall for their phishing attempt.
• Notify you that you’re a ’winner.’ Maybe the email claims to be from a lottery, or a dead relative, or the millionth person to click on their site, etc. In order to give you your ’winnings’ you have to provide information about your bank routing so they know how to send it to you or give your address and phone number so they can send the prize, and you may also be asked to prove who you are often including your social security number. These are the ’greed phishes’ where even if the story pretext is thin, people want what is offered and fall for it by giving away their information, then having their bank account emptied, and identity stolen.
• Pose as a boss or coworker. It may ask for an update on an important, proprietary project your company is currently working on, for payment information pertaining to a company credit card, or some other inquiry masquerading as day-to-day business. 

Baiting scenarios 

These social engineering schemes know that if you dangle something people want, many people will take the bait. These schemes are often found on Peer-to-Peer sites offering a download of something like a hot new movie, or music. But the schemes are also found on social networking sites, malicious websites you find through search results, and so on.

Or, the scheme may show up as an amazingly great deal on classified sites, auction sites, etc.. To allay your suspicion, you can see the seller has a good rating (all planned and crafted ahead of time).

People who take the bait may be infected with malicious software that can generate any number of new exploits against themselves and their contacts, may lose their money without receiving their purchased item, and, if they were foolish enough to pay with a check, may find their bank account empty.

Response to a question you never had

Criminals may pretend to be responding to your ’request for help’ from a company while also offering more help. They pick companies that millions of people use such as a software company or bank.  If you don’t use the product or service, you will ignore the email, phone call, or message, but if you do happen to use the service, there is a good chance you will respond because you probably do want help with a problem.

For example, even though you know you didn’t originally ask a question you probably a problem with your computer’s operating system and you seize on this opportunity to get it fixed. For free! The moment you respond you have bought the crook’s story, given them your trust and opened yourself up for exploitation.

The representative, who is actually a criminal, will need to ’authenticate you’, have you log into ’their system’ or, have you log into your computer and either give them remote access to your computer so they can ’fix’ it for you, or tell you the commands so you can fix it yourself with their help–where some of the commands they tell you to enter will open a way for the criminal to get back into your computer later.

Creating distrust

Some social engineering, is all about creating distrust, or starting conflicts; these are often carried out by people you know and who are angry with you, but it is also done by nasty people just trying to wreak havoc, people who want to first create distrust in your mind about others so they can then step in as a hero and gain your trust, or by extortionists who want to manipulate information and then threaten you with disclosure.

This form of social engineering often begins by gaining access to an email account or another communication account on an IM client, social network, chat, forum, etc. They accomplish this either by hacking, social engineering, or simply guessing really weak passwords.

• The malicious person may then alter sensitive or private communications (including images and audio) using basic editing techniques and forwards these to other people to create drama, distrust, embarrassment, etc.  They may make it look like it was accidentally sent, or appear like they are letting you know what is ’really’ going on.
• Alternatively, they may use the altered material to extort money either from the person they hacked or from the supposed recipient.

There are literally thousands of variations to social engineering attacks. The only limit to the number of ways they can socially engineer users through this kind of exploit is the criminal’s imagination.  And you may experience multiple forms of exploits in a single attack.  Then the criminal is likely to sell your information to others so they too can run their exploits against you, your friends, your friends’ friends, and so on as criminals leverage people’s misplaced trust.

Don’t become a victim

While phishing attacks are rampant, short-lived, and need only a few users to take the bait for a successful campaign, there are methods for protecting yourself. Most don’t require much more than simply paying attention to the details in front of you. Keep the following in mind to avoid being phished yourself. 

Tips to Remember:

• Slow down. Spammers want you to act first and think later. If the message conveys a sense of urgency or uses high-pressure sales tactics be skeptical; never let their urgency influence your careful review.
• Research the facts. Be suspicious of any unsolicited messages. If the email looks like it is from a company you use, do your own research. Use a search engine to go to the real company’s site, or a phone directory to find their phone number.
• Don’t let a link be in control of where you land. Stay in control by finding the website yourself using a search engine to be sure you land where you intend to land. Hovering over links in email will show the actual URL at the bottom, but a good fake can still steer you wrong.
• Email hijacking is rampant. Hackers, spammers, and social engineers taking over control of people’s email accounts (and other communication accounts) has become rampant. Once they control an email account, they prey on the trust of the person’s contacts. Even when the sender appears to be someone you know, if you aren’t expecting an email with a link or attachment check with your friend before opening links or downloading.
• Beware of any download. If you don’t know the sender personally AND expect a file from them, downloading anything is a mistake.
• Foreign offers are fake. If you receive an email from a foreign lottery or sweepstakes, money from an unknown relative, or requests to transfer funds from a foreign country for a share of the money it is guaranteed to be a scam.

Ways to Protect Yourself:

• Delete any request for financial information or passwords. If you get asked to reply to a message with personal information, it’s a scam.
• Reject requests for help or offers of help. Legitimate companies and organizations do not contact you to provide help. If you did not specifically request assistance from the sender, consider any offer to ’help’ restore credit scores, refinance a home, answer your question, etc., a scam. Similarly, if you receive a request for help from a charity or organization that you do not have a relationship with, delete it. To give, seek out reputable charitable organizations on your own to avoid falling for a scam.
• Set your spam filters to high. Every email program has spam filters. To find yours, look at your settings options, and set these to high–just remember to check your spam folder periodically to see if legitimate email has been accidentally trapped there. You can also search for a step-by-step guide to setting your spam filters by searching on the name of your email provider plus the phrase ’spam filters’.
• Secure your computing devices. Install anti-virus software, firewalls, email filters and keep these up-to-date. Set your operating system to automatically update, and if your smartphone doesn’t automatically update, manually update it whenever you receive a notice to do so. Use an anti-phishing tool offered by your web browser or third party to alert you to risks.

Web-root’s threat database has more than 600 million domains and 27 billion URLs categorized to protect users against web-based threats. The threat intelligence backing all of our products helps you use the web securely, and our mobile security solutions offer secure web browsing to prevent successful phishing attacks.

By, Athyuth Nair P

“Achieving success via Social Networks is directly proportional to the right implications of do’s and don’ts of Social Media Etiquette.“

Do’s…

• Make your profiles private, if that’s an option.
• Form as many connections as you can with other students, professionals, or people related to your studies or field of interest. This could be on a platform like LinkedIn.
• Upload pictures from your semester or year abroad! This can show you are interested in visiting new places and cultures and can show that you are an open-minded person. Moreover, this also goes for any other trips abroad you’ve done during summer vacation, for example.
• Show that you have interests and hobbies and that you are a well-rounded person.
• Add yourself to all the groups you are involved in. This type of information is usually displayed on your profile. If you are involved in a student association or volunteer, you should definitely showcase it!
• Share articles you find interesting. It might be a good idea to have some sort of social media presence in the field you are interested in!
• Google yourself to see what comes up. If there is something you don’t like the look of, you can edit or delete it.
• Are you a student entrepreneur or have your own business? Flaunt it! Use social media to promote yourself and your business and make connections that might be useful for you in the future.

Don’ts…

• Be negative or aggressive online. Free speech is important and you are entitled to your opinions but be smart about it. Basically, don’t be a hater and don’t be a troll. Hateful, harmful and hurtful comments will not paint a positive picture of you. Beyond that, being a decent and courteous human being online isn’t that hard.
• Post anything illegal. That means drugs, violence, or any sort of stealing or damaging of property!
• Share sexually explicit stuff…you know what we’re talking about. That can come back to haunt you in the long run.
• Rely on privacy settings. They aren’t always as reliable as you might think them to be.
• Have an embarrassing or inappropriate handle or name. This is on-par with having an email address like barbiepricess@hotmail.com or markisthebest2406 or something equally bad and cringy.
• Use strange or inappropriate hashtags. Hashtags are often forgotten but you can also be found using them!

In short, be aware of what you post on your social media or networking profiles because what goes around, comes around. With these do’s and don’ts, you’ll be the most social media-savvy student ever!

–Girish R Purohit (MSc. Cyber security )

In previous blogs, we saw what is irresponsible internet behavior and also about the misinformation which we netizens spread viz social media.

So, now let’s see some of the irresponsible behaviors which can lead to cyber crimes and also to physical damages to the victims along with some of the safety tips so that we can remain safe from them:

#1: Cyber-bullying

On the Internet, cyber-bullying takes various forms. Cyber-bullying includes sending hateful messages or even death threats to children, spreading lies about them online, making nasty comments on their social networking profiles, or creating a website to bash their looks or reputation.

Cyber-bullying differs from schoolyard bullying. Teachers can’t intervene on the Internet. When it happens online, there’s no one to filter it and cyberbullies don’t witness their victims’ reactions, the way they might if they insulted others to their faces. They don’t see you crying, which may make it easier for them to continue.

Some cyberbullies pose as their victims and send out harassing messages to others. Recently, cyberbullies have also begun posting humiliating videos of other kids they dislike, says Parry Aftab, a cyberspace security and privacy lawyer who also serves as executive director of WiredSafety.org, one of the largest Internet safety education groups in the world.

In the age of YouTube, a website that hosts videos shot by users, “Kids are looking for their 15 megabytes of fame,” Aftab says. “They do it to show that they’re big enough, popular enough, cool enough to get away with it.”

Often, kids don’t tell parents they’re being cyber-bullied; they’re afraid their parents will overreact or yank Internet privileges, Aftab adds. Her advice? If your son or daughter tells you, stay calm. If it’s a one-time thing, try to ignore the bully and block future contact, she says. But if the cyber-bullying involves any physical threat, you may need to call the police.

Internet safety tips:

• To keep others from using their email and Internet accounts, kids should never share Internet passwords with anyone other than parents, experts say.

• If children are harassed or bullied through instant messaging, help them use the “block” or “ban” feature to prevent the bully from contacting them.

• If a child keeps getting harassing emails, delete that email account and set up a new one. Remind your child to give the new email address only to family and a few trusted friends.

• Tell your child not to respond to rude or harassing emails, messages and postings. If the cyber-bullying continues, call the police. Keep a record of the emails as proof.

Internet Danger #2: Sexual Predators

The online world opens the door for trusting young people to interact with virtual strangers – even people they’d normally cross the street to avoid in real life. About 1 in 7 kids have been sexually solicited online, says John Shehan, CyberTipline program manager for the National Center for Missing and Exploited Children in Alexandria, Virginia. The CyberTipline helps prevent sexual exploitation of children by reporting cases of kids enticed online to do sexual acts.

While sexual predators have targeted children in chat rooms, they migrate to wherever young people go online, Shehan says. More predators are now scouring social networking sites, such as MySpace and Xanga, because these sites have centralized so much information, Shehan says. A child’s profile typically includes photos, personal interests and blogs.

“In terms of predators, that’s obviously a hot spot where they can go to research victims,” Shehan says. “They need to meet these kids, groom these children and become friends.”

Predators may take on fake identities and feign interest in a child’s favorite bands, TV shows, video games or hobbies. “They come across to the children as their new best friend. They’re going to have the same likes and dislikes,” Shehan says. “It’s quite crafty what these child predators will go through.”

Internet Safety Tips:

• Ask your children if they use a social networking site. Look at the site together or search for it yourself online. Social networking sites often have age limits. MySpace prohibits kids under 14 – but doesn’t verify kids’ ages, so anyone can use it. If you want to delete a site, work with your child to cancel the account, or contact the social networking site directly.

• Tell your kids not to post a full name, address, phone number, school name and other personal information that could help a stranger to find them. Remind them that photos – like your child in a team sweatshirt – can give away clues to where they live. Ask them not to send photos to people they meet online.

• Learn about privacy settings that allow kids to choose who can view their profiles. Explain that strangers who approach them online aren’t always who they say they are – and that it’s dangerous to meet them in real life. Tell them to “instant message” only with family or friends they already know off-line.

• When it comes to Internet safety, there’s no substitute for parental supervision. Put your computer in a common area of your home, not a child’s bedroom, so you can keep an eye on online activities. Go to websites that explain the short-hand kids use in instant messaging, like “POS” (“parent over shoulder”) or “LMIRL” (“let’s meet in real life”), so you know what’s going on.

• Ask your kids to report any online sexual solicitation to you or another trusted adult right away. Also parents should call their local police and save all offensive emails as evidence.

Internet Danger #3: Pornography

One of the worst dangers of the Internet, for many parents, is the idea that pornography could pop up and surprise their children. But parents may not realize that some kids are going online to seek out web porn, too.

You can view the Internet browser history to see which websites your child is visiting, Shehan says. But since kids can delete this history, you may want to install Internet filtering software to block porn sites in the first place.

Software filters aren’t a perfect solution; some nasty sites can slip through, while educational or family-rated sites may be blocked. So while some parents may wonder whether monitoring means they’re spying on their kids, the safety factor often wins out. “If you get the monitoring software, put it on the computer and forget that it’s there,” Aftab says. That way, if someone’s viewing porn, you’ll have the records to deal with it.

Internet Safety Tips

• Install Internet filtering software to block porn sites from any computer your child has access to.

• Consider using filtering software that monitors and records instant messaging and chat room conversations, as well as websites visited.

• Consider using a monitoring program that filters pornography keywords in several languages. Why? Because some teens have figured out how to get around filters by typing in porn-related search terms in other languages.

Internet Danger #4: Damaged Reputations

Camera phones, digital cameras and web cams are everywhere these days, and kids can be victims of their own inexperience with new technology. Many post pictures, videos or notes online that they later regret. “Think before you post, because once you do, it’s going to be up there forever,” Shehan says.

A child’s online reputation is a growing concern, Aftab says, with the rise of online social networking and profiles. She cites reports of schools and employers rejecting young people for high school programs, internships, college admissions and jobs after checking out what applicants have posted online.

Many teenage girls put up provocative photos of themselves, Shehan says. Why? Handy – a teenager herself – believes it’s a game of one-upmanship. “Kids are trying to look cool. They’re doing it because everyone else is doing it. A girl will see a picture and say, ‘Oh, I can top that.’ And before you know it, she’s half-naked on the Internet for everybody to see.”

Internet Safety Tips

• Explain that even if your kids delete their posted photos, others may have already copied them into public forums and websites.

• Tell your kids not to let anyone, even friends, take pictures or videos of them that could cause embarrassment online – such as if a relative or teacher saw them.

• Talk to your kids about possible consequences, the experts say. A 17-year-old might think it’s hilarious to post a MySpace photo of himself looking drunk, with empty beer bottles strewn around him. But will a college admissions officer be impressed? Probably not.

At last, I would like to say that above mentioned are counted as cyber crimes and can land us to jail. Also, the victim of these crimes can suffer trauma which might last for years. So, one should behave responsibly in the world of internet.

By: Harshit Agarwal, M.Sc. (Cyber Security), AUR

Corruption is an infection that seems to be growing day by day. It is digging its teeth in every strata of the society, be it the poor, the middle class or the rich, no one is safe from its crutches. It has spread its roots in the minds of bad people. A lot of people do not choose to take bribes, but circumstances in their lives possess them to get into such activities which harm them one way or another. The corrupt become used to their works and normalize the risk involved. One step into this may harm or scar you for your entire life. People who get caught for corruption aren’t left easily; as we are not the only entities on this planet earth, we must think about others and continue to live in peace and harmony with other, without succumbing to greed.

There are various reasons for corruption in the society. Many politicians are making laws to fulfill their own. These laws are made to suit their own needs and wishes. Instead of making laws for the citizen’s welfare, they are making laws to fulfill their greed. The intensity of trust, faith and honesty is decreasing every day, which is giving rise to the corruption.

Not only the people in power but also the normal people are equally responsible for this menace. To speed up the process to get out of the crime, people bribe government officials and thus also become the part of this evil system. Nowadays people are paying bribes for not only getting the wrong things done but also for getting the right things done at the right time. Social corruption like less weighing of products, adulteration in edible items, and bribery of various kind have also perpetually prevailed in our society.

Every day, common people are getting more and more used to the increasing corruption. There is a lack of strong dialogue in the society against corruption, illiteracy which makes it easy for people to do a lot of these illegal activities because they haven’t been educated about these things. Government officials with low salaries turn to corruption in order to run their households, whereas, people in the higher ranks take to corruption to fulfill their wishes. Elections are the time where corruption is at its peak.

There is a growing need to educate people about what’s right and what’s wrong in the society and the world. People are to be taught that getting into risky things like corruption has its repercussions.

-By Chakradhar singh, M.sc. Cyber Security